Attack Chain

1. Attacker identifies a WordPress site with the vulnerable CleanTalk plugin installed and user registration enabled.
2. Attacker submits a registration request using a malicious payload in the 'user_email' field.
3. The plugin fails to sanitize the malicious input and stores it in the WordPress database.
4. The plugin flags the registration as spam or 'non-checkable' based on its internal logic.
5. An administrator navigates to the plugin's dashboard to review the spam reports.
6. The plugin displays the list of spam users, causing the stored XSS payload to execute within the administrator's browser session.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of an administrator's browser session. This can lead to unauthorized actions performed on behalf of the administrator, such as creating new administrative accounts, modifying plugin settings, or redirecting site traffic.

Recommendation

Update the "Anti-Spam by CleanTalk - Spam Protection Without CAPTCHA" plugin to the latest version available beyond 6.89.1. Ensure user registration settings are restricted to known users until a patch is applied if the plugin cannot be updated immediately.